The root case was a canister doing a bunch of tiny stable memory operations. It was not a malicious code, but just a super inefficient way of using the stable memory to the extent it was slowing down the whole subnet…
There are a few points to improve form there. On one side, by increasing the complexity of those system API calls, we’re closing a potential DoS attack vector. On the other side, we’re putting a lot of efforts to make the orthogonal persistency faster (see recent perf optimizations) and safer (see canister sandboxing).
Those talks touch a bit the design patterns to avoid. There is also a related post on this forum.
True, there are a lot of open questions on dev tooling side. We have plans to improve there, so stay tuned!